For more information regarding the security incident at F5, the actions we are taking to address it, and our ongoing efforts to protect our customers, click here.

Forum Discussion

Albert_252822's avatar
Albert_252822
Icon for Nimbostratus rankNimbostratus
Aug 22, 2016

ASM iRule events not working

Hi all, I activated this irule in my Virtual Server:   when HTTP_REQUEST { set redirect 0 set requri [HTTP::uri] } when ASM_REQUEST_BLOCKING { set redirect 1 } when HTTP_RESPONSE {...
ASM Advanced WAF
asm irules
security
Hannes_Rapp's avatar
Hannes_Rapp
Icon for Nimbostratus rankNimbostratus
Aug 22, 2016

Have not tested, but in theory, this should do what you want:

 

when ASM_REQUEST_DONE {
  if { [ASM::status] equals "blocked" } {
    switch -glob [string tolower [HTTP::path]] {
      "/url1*" { 
        ASM::unblock
        HTTP::respond 302 Location "https://url1/index" Connection Close
      }
      "/url2*" { 
        ASM::unblock
        HTTP::respond 302 Location "https://url2/index" Connection Close
      }
      "/url3*" { 
        ASM::unblock
        HTTP::respond 302 Location "https://url3/index" Connection Close
      }
      default { }
    }
  }
}

 

Albert_252822's avatar
Albert_252822
Icon for Nimbostratus rankNimbostratus
Aug 23, 2016

Hi Hannes, thanks for your help.

 

I tested this irule replacing my whole irule and it doesn't work. I have the same result, after a violation I see the ASM Default Response Page.

 

I'm sure I'm missing something but I can't find it. My ASM Security Policy has "Trigger ASM iRule Events" enabled and "ASM iRules Event Mode" in Normal Mode. I also have the Default Response Page configured (code 200 - OK)